Splash in PID 1

Question

I have just started learning about processes in Linux.

I have come around this command called ps -ef (which will show all the running processes).

I get output like this

UID        PID  PPID   LWP  C NLWP STIME TTY          TIME CMD
root         1     0     1  0    1 Apr17 ?        00:00:18 /sbin/init splash

What does splash represent here? I know init is the first process that runs when we start up the computer. But what is splash? What does it do?

Also, can anybody tell me why init is called the first process to be run, but it is the BIOS or UEFI program that first runs when we start up the computer. So why do we call init the first process, and not BIOS or UEFI?

In addition to answers, just wanted to highlight splash screen and bootsplash are different things. — GypsyCosmonaut, Jun 03 '21 at 00:05

thecarpy · Answer 1 · 2019-05-17T21:21:50.080

What does splash represent here? I know init is the first process that runs when we start up the computer. But what is splash ? What does it do ?

First of all, you are runnning ubuntu which uses systemd, which allows you to display a splash screen during boot, this is why it has the splash argument. See the splash.c source code.

[EDIT] Your computer is running systemd because, afaik, systemd is the only init I know of that supports the splash parameter - there might be others, but since it is also the default on Ubuntu, I think it is a safe guess. On Ubuntu, by default, /sbin/init is a symbolic link to /usr/lib/systemd/systemd, the kernel loaded /sbin/init splash, ps here uses the command line of the process, which will be /sbin/init splash, and that is what you see.

Also can anybody tell me init is called the first process to be run but it is the BIOS or UFEI program that first run when we start up the computer . So why we called init as the first process not BIOS or UFEI?

Ok, to keep things simple, the BIOS/UEFI are programs that get loaded at boot, they contain config data for further booting the system. They will eventially locate the next program to boot, such as a boot manager (e.g. grub) which will in its turn allow you to launch a kernel. I am trying to keep it simple, here, but you can read it up. on linux and unix systems, init is the first program spawned by the kernel and thus gets PID 1.

You can read up more here, actually, that article is pretty old. I do not claim what follows is 100% accurate.

The first thing you do to bootstrap or boot a x86 computer is press the power button. Your powersupply powers up the motherboard and waits for a signal from the SMPS (Switching Mode Power Supply) that enough power can be provided. For example, it checks that your PCIe graphics card gets enough juice, that a CPU and RAM is there.

The Intel Management Engine (IME)/AMD Secure Technology start at this point, the IME is a separate Intel CPU with an obfuscated minix 3 operating system, the AMD equivalent uses an ARM core embedded on the central CPU; little more is known about these two.

Once the motherboard receives the SMPS it stops constantly resetting the CPU, the CPU now reads an address in the ROM, this is usually FFFF:0000h; it contains a jump (like a shortcut) to firmware code.

This firmware used to be one monolithic block of code that one called BIOS and could only be used with a keyboard. With UEFI, this has now become an entire OS with mini filesystem. Today, the jump points at some bootstrapping code (one could probably call BIOS) that decompresses the UEFI. The UEFI likes a mini operating system and may feature mouse support, network boot, SCSI, RAID, disk and/or memory checkers, and many other features.

The UEFI, once loaded, performs a Power on Self Test (POST) which checks if all the hardware is OK.

The full POST checks many devices such as CMOS, video ROM's, controllers, DMA (which allows devices direct access to RAM), CPU, memory and other devices. When you reset a PC, that is, you press the reset button or execute a reboot command, a simple POST is performed which will not notice if there is a problem with CMOS, for example. CMOS is a little chip on your motherboard of volatile memory (cut power and the memory is lost) and a clock, it is powered by a small battery and contains all the settings for the UEFI.

The UEFI reads these settings, makes any changes to the system required, and proceeds with bootstrapping the system further. The UEFI can either perform a legacy boot by looking for a boot record on a drive or use the more modern UEFI boot method. This requires a FAT32 formatted partition with UEFI bootstrapping code that can load Linux kernel, boot manager (Windows) or a bootloader such as grub.

The kernel on UNIX systems loads all needed device drivers and then an init process. Init can be systemd or any other program such as bash; you configure it in kernel parameters. Note that if you choose to load the kernel directly with UEFI, it is much harder to set kernel parameters. Once lodaed, init gets PID 1 and then loads the userland (the system shell and, optionnaly, a graphical user interface).

The cmd says /sbin/init
INIT ! why did you say my mahcine (ubuntu) is running systemd ? Can you explain. — Thelostcause, May 16 '19 at 12:36

score 2 · Answer 2 · 2019-06-23T00:06:08.120

What does splash represent here?

It's the name of the kernel image/file that was booted. Or just the first argument of the kernel command line, as you get with

cat /proc/cmdline

Which gives me usually the three arguments:

[kernelname] [initrd=...] [root=...]

The default name for a kernel is vmlinuz. I guess splash must be ubuntu's name for their kernel with a splash screen built in.

This (showing "splash") is a systemd feature, with sysvinit it was just "/sbin/init". It is nice, but a bit of a cheat, because init does not get called with a kernel image, but BY the kernel, with the remaining boot parameters.

And /sbin/init is (under systemd as pid#1) a link to the systemd binary /lib/systemd/systemd.

So why we call init as the first process not BIOS or UFEI?

[UEFI! UE-Firmware-Interface]

"Init" is simply the first Linux process. Starting /sbin/init is the last thing the kernel does.

Remember Linux started out with the idea of making use of the Protected Mode of the 386-CPUs. Without this mode you have no real processes.

In a way, the Linux Kernel itself just sets up an efficient process generating system. What you make of it is up to you: you can just boot with init=/bin/bash into a system with only one or two MB. You can then still start bash jobs in the background or start a binary that forks as it likes. Or start another bash "on top' of the first. But one "exit" too much in your shell and you drop back to the kernel who immediately panics.

...or you can use sysvinit as first process. This classical init starts a login-process for each tty you define. And this is where you get the Alt-key for switching from one process to another. From a tty you can then start other processes, and /etc/inittab can by configured to start a graphical 'shell' directly.

...or you can use (since 2012) systemd as "init", with added functionality. Most of it is done by other systemd binaries.

So, init is by definition the first binary executed by the kernel: the kernel starts one init, and then this init starts one or more processes (logins, daemons).

Early CPU activity, even resulting in a Visual UEFI-BIOS and a UEFI-Shell (NOT at the same time of course), is not called a process, even though a processor is processing code :-)

@Stephen:

There are initrd=, rdinit= and init= bootparameters. initrd= names the file/image of the ramdisk, with rdinit= you can change /init (which file the ramdisk should execute first) and with init= you can change /sbin/init.

I think you quite mix this up in your link. Maybe because /init in the initrd-fs is controlled by rdinit= and init in sbin by init=

i played around with these options a lot lately - independant of any distro or even bootloader. I start from the UEFI-Shell which acts just like a boot loader, except you can choose any kernel and initrd on the fly - as long as they are inside of the EFI System Partition.

So with:

fedora\vmlinuz root=/dev/sda2

I can successfully boot the kernel of fedora 29 - without an initrd.

All the other kernels I tried need initrd because they lack sata/scsi modules.

arch5\vmlinuz-linux initrd=arch5\initramfs-linux.img root=/dev/sda3 init=/usr/bin/sysvinit

This is how I start exactly the system I am on now, but with old sysvinit instead of /sbin/init (which is a link to /lib/systemd/systemd). Here it is archlinux' /init that uses root= to switch_root to /dev/sda3 and init= to start something else than /sbin/init.

I also booted by manipulating /init, rearchiving it and entering.

arch\vmlinuz.4.20.6 initrd=arch\archsam.cpio

No root= here, because I hard-coded the root partition in /init.

PS:

[    0.000000] Linux version 5.1.12-arch1-1-ARCH (builduser@heftig-24809) (gcc version 9.1.0 (GCC)) #1 SMP PREEMPT Wed Jun 19 09:16:00 UTC 2019
[    0.000000] Command line: arch5\vmlinuz-linux initrd=arch5\initramfs-linux.img root=/dev/sda3

These are my first two kernel message lines. Again, notice the backslash in arch5\vmlinuz-linux!

And ps axf gives me this (without kernel threads 2 to about 200):

    1 ?        Ss     0:01 /sbin/init arch5\vmlinuz-linux
  291 ?        Ss     0:00 /usr/lib/systemd/systemd-journald
  304 ?        Ss     0:00 /usr/bin/lvmetad -f
  315 ?        Ss     0:00 /usr/lib/systemd/systemd-udevd
  321 ?        Ss     0:00 /usr/lib/systemd/systemd-networkd
  453 ?        Ssl    0:00 /usr/lib/systemd/systemd-timesyncd
  456 ?        Ss     0:05 /usr/lib/systemd/systemd-resolved
  466 ?        Ss     0:02 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
  467 ?        Ss     0:00 /usr/lib/systemd/systemd-logind
  469 ?        Ss     0:00 login -- root
  484 tty1     Ss     0:00  \_ -bash
  922 tty1     S+     0:00      \_ xinit fvwm
  923 tty2     S<sl+   8:08          \_ /usr/lib/Xorg :0
  930 tty1     S      0:00          \_ xterm -geometry +1+1 -n login fvwm
  932 pts/0    Ss+    0:08              \_ fvwm
  937 pts/0    S+     0:00                  \_ /usr/lib/fvwm/2.6.8/FvwmButtons 9 4 none 0 8 RightPanel
  938 pts/0    S+     0:00                  \_ /usr/lib/fvwm/2.6.8/FvwmEvent 11 4 none 0 8 EventNewDesk
  939 pts/0    S+     0:00                  \_ /usr/lib/fvwm/2.6.8/FvwmPager 13 4 none 0 8 *
  940 pts/0    S+     0:01                  \_ /usr/lib/fvwm/2.6.8/FvwmIconMan 15 4 none 0 8
  941 pts/0    S+     0:04                  \_ /usr/lib/fvwm/2.6.8/FvwmScript 17 4 none 0 8 FvwmScript-DateTime
  955 pts/0    Sl    22:28                  \_ /usr/lib/firefox/firefox
 1049 pts/0    Sl    18:08                  |   \_ /usr/lib/firefox/firefox -contentproc -childID 1 -isForBrowser -prefsLen 1 -prefMapSize 179366 -parentBuildID 20190620195126 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 955 true tab
 1129 pts/0    Sl     0:46                  |   \_ /usr/lib/firefox/firefox -contentproc -childID 2 -isForBrowser -prefsLen 5850 -prefMapSize 179366 -parentBuildID 20190620195126 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 955 true tab
 8411 pts/0    Sl     0:24                  |   \_ /usr/lib/firefox/firefox -contentproc -childID 5 -isForBrowser -prefsLen 7065 -prefMapSize 179366 -parentBuildID 20190620195126 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 955 true tab
31147 pts/0    Sl     0:00                  |   \_ /usr/lib/firefox/firefox -contentproc -childID 10 -isForBrowser -prefsLen 9059 -prefMapSize 179366 -parentBuildID 20190620195126 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 955 true tab
32497 pts/0    Sl     0:04                  |   \_ /usr/lib/firefox/firefox -contentproc -childID 11 -isForBrowser -prefsLen 9059 -prefMapSize 179366 -parentBuildID 20190620195126 -greomni /usr/lib/firefox/omni.ja -appomni /usr/lib/firefox/browser/omni.ja -appdir /usr/lib/firefox/browser 955 true tab
11810 pts/0    S      0:00                  \_ xterm
11812 pts/1    Ss     0:00                      \_ bash
  406 pts/1    R+     0:00                          \_ ps axf

I checked ubuntu and splash...splash is a grub parameter, giving them some problems on its own. To me

/sbin/init splash-option

makes no sense, but

/sbin/init first-part-of-cmd-line

does make sense.

BTW you know this comment in init/main.c about LILO somehow passing "auto" to the command line? This commandline parsing by bootloader, kernel, initrd/init and /sbin/init (for the runlevel, or systemd-target) is not so simple.

ADDED:

"man ps" says:

   args        COMMAND   command with all its arguments as a string.
                         Modifications to the arguments may be shown.
                         The output in this column may contain spaces.
                         A process marked <defunct> is partly dead,
                         waiting to be fully destroyed by its parent.
                         Sometimes the process args will be unavailable;
                         when this happens, ps will instead print the
                         executable name in brackets.

So that is how [kthreadd] with pid 2 and its child-processes get their brackets! I just wonder why "modifications to the arguments" MAY be shown.

On my archlinux "ps axf" shows "sbin/init arch5\vmlinuz-linux" and that "argument" is exactly the command I entered at my UEFI-Shell prompt. Even the backslashes survived. After that I typed initrd= and root= ...just like a bootloader does. Modules, runlevels and targets come afterwards. — , Jun 22 '19 at 17:49
On Arch Linux perhaps, but in the context of this question, splash has nothing to do with the name of the kernel. — Stephen Kitt, Jun 22 '19 at 18:17
So how does "splash" get into the place it is: the argument to sbin/init as ps sees it? This is a systemd thing, I was very surprised to see it. It might also be some boot parameter from the bootloader flying around. But the idea is to show the kernel name. If "ps axf" shows up in its own output WITH arguments "axf", why should /sbin/init stand naked? — , Jun 22 '19 at 19:33
The answers to this question should help you understand what’s going on. The idea isn’t to show the kernel name... — Stephen Kitt, Jun 22 '19 at 19:40
The idea of what? I meant init's new idea to modify it's name. The idea of "splash" is to show a splash screen. The idea of the (kernel) command line (parameters/options) is to set options along the boot process. Now all these nice ideas end up in "splash" as apparent argument to pid 1 init process. This is a bit tragicomic for Linux (-distros). I would say, this splash screen really is an eye-catcher... — , Jun 23 '19 at 00:34

Splash in PID 1

2 Answers2

Linked